greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Configure Dendrite on kubernetes

Browse Source 
Configure a matrix database
Configure Dendrite into Kubernetes
Update vps configuration to new settings
This commit is contained in:
Greg Hellings
2025-05-26 23:37:24 -05:00
parent ce5f604636
commit 26d4e9b771
20 changed files with 338 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/modules/baseline/xonsh_footer.xsh
+4 -8
View File
@@ -7,14 +7,10 @@ def bw_unlock():
current environment variables. Also returns the code for them."""
if "BW_SESSION" in ${...}:
return $BW_SESSION
result = $(bw unlock)
while "BW_SESSION" not in result:
result = $(bw unlock)
lines = result.split("\n")
l = [k for k in lines if 'BW_SESSION="' in k][0]
left, right = l.split("=", 1)
token = right[1:-1]
$BW_SESSION = token
result = !(bw unlock --raw)
while result.returncode != 0:
result = !(bw unlock --raw)
$BW_SESSION = result.output.strip()
return token
def vpn(con, bwname):
hosts/genesis/net/hosts
+3 -3
View File
@@ -9,7 +9,7 @@
10.42.1.3 printer.thehellings.lan
10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan
10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan
10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan pgadmin.thehellings.lan
10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan
10.42.1.7 hosea hosea.thehellings.lan
10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
10.42.1.9 ivr ivr.thehellings.lan
@@ -32,8 +32,8 @@
100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
100.68.203.1 hosea.home hosea.shire-zebra.ts.net
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net
100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes
100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
100.90.74.19 jude.home
100.115.57.8 linode.home
100.65.5.38 matrix.home matrix.shire-zebra.ts.net
hosts/linode/matrix.nix
+10 -2
View File
@@ -14,7 +14,6 @@ in
"${domain}" = {
enableACME = true;
forceSSL = true;
# This is needed so that servers contacting hellings.com can find
# the actual application server at matrix.thehellings.com
locations."= /.well-known/matrix/server".extraConfig =
@@ -51,11 +50,20 @@ in
enableACME = true;
forceSSL = true;
extraConfig = ''
error_log /var/log/nginx/debug.log debug;
'';
# Not the appropriate place for the chat client
locations =
(builtins.listToAttrs (
builtins.map
(val: lib.nameValuePair "/_${val}" { proxyPass = "http://matrix.shire-zebra.ts.net:8448"; })
(
val:
lib.nameValuePair "/_${val}" {
proxyPass = "http://matrix.kubernetes";
}
)
[
"matrix"
"synapse"
manifests/databases/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- postgres-cluster.yaml
- postgres-gitlab.yaml
- postgres-pgadmin.yaml
- postgres-matrix.yaml
manifests/databases/postgres-cluster.yaml
+7
View File
@@ -24,3 +24,10 @@ spec:
superuser: true
passwordSecret:
name: postgres-user-pgadmin
- name: matrix
ensure: present
comment: Matrix DB user
login: true
superuser: false
passwordSecret:
name: postgres-user-matrix
manifests/databases/postgres-matrix.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
name: database-matrix
spec:
name: matrix
owner: matrix
cluster:
name: postgres
manifests/databases/postgres-pgadmin.yaml
+1 -1
View File
@@ -95,7 +95,7 @@ metadata:
ingressClassName: traefik
spec:
rules:
- host: pgadmin.thehellings.lan
- host: pgadmin.kubernetes
http:
paths:
- path: /
manifests/kustomization.yaml
+1
View File
@@ -3,3 +3,4 @@ resources:
- bitwarden
- secrets
- databases
- matrix
manifests/matrix/dendrite-config.yaml
+189
View File
@@ -0,0 +1,189 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: dendrite-config
spec:
data:
- &secret
secretKey: username
sourceRef:
storeRef:
name: bitwarden-login
kind: ClusterSecretStore
remoteRef: &remoteRef
key: 36d1046b-727e-4e09-a391-b2e90171d3d0
property: username
- <<: *secret
secretKey: password
remoteRef:
<<: *remoteRef
property: password
- secretKey: matrix_pem
sourceRef:
storeRef:
name: bitwarden-notes
kind: ClusterSecretStore
remoteRef:
key: 6de3500c-7c6e-4419-b4f5-b2ea0018ff28
target:
name: dendrite-config
deletionPolicy: Delete
template:
engineVersion: v2
data:
matrix.pem: "{{ .matrix_pem }}"
dendrite.yaml: |
version: 2
global:
server_name: thehellings.com
key_id: ed25519:auto
private_key: /etc/dendrite/matrix.pem
database:
connection_string: "postgres://{{ .username | urlquery }}:{{ .password | urlquery }}@postgres-rw.db.svc.cluster.local/matrix?sslmode=disable"
max_open_conns: 90
max_idle_conns: 2
conn_max_lifetime: -1
well_known_server_name: "http://matrix.thehellings.com"
well_known_client_name: "http://matrix.thehellings.com"
well_known_sliding_sync_proxy: ""
disable_federation: false
presence:
enable_inbound: false
enable_outbound: false
trusted_third_party_id_servers:
- matrix.org
- vector.im
jetstream:
storage_path: /var/dendrite
addresses: []
topic_prefix: Dendrite
in_memory: false
disable_tls_validation: true
credentials_path: ""
metrics:
enabled: false
basic_auth:
username: metrics
password: metrics
sentry:
enabled: false
dsn: ""
environment: ""
dns_cache:
enabled: false
cache_size: 256
cache_lifetime: 5m0s
server_notices:
enabled: true
local_part: _server
display_name: Server Alert
avatar_url: ""
room_name: Server Alert
report_stats:
enabled: false
endpoint: https://panopticon.matrix.org/push
cache:
max_size_estimated: 1073741824
max_age: 1h0m0s
app_service_api:
disable_tls_validation: false
legacy_auth: false
legacy_paths: false
config_files: []
client_api:
registration_disabled: true
registration_requires_token: false
registration_shared_secret: ""
guests_disabled: false
enable_registration_captcha: false
recaptcha_api_js_url: ""
recaptcha_sitekey_class: ""
recaptcha_form_field: ""
recaptcha_public_key: ""
recaptcha_private_key: ""
recaptcha_bypass_secret: ""
recaptcha_siteverify_api: ""
turn:
turn_user_lifetime: ""
turn_uris: []
turn_shared_secret: ""
turn_username: ""
turn_password: ""
rate_limiting:
enabled: true
threshold: 5
cooloff_ms: 500
exempt_user_ids: []
federation_api:
send_max_retries: 16
enable_relays: false
p2p_retries_until_assumed_offline: 1
disable_tls_validation: false
disable_http_keepalives: false
key_perspectives:
- server_name: matrix.org
keys:
- key_id: ed25519:auto
public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
- key_id: ed25519:a_RXGa
public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
prefer_direct_fetch: false
deny_networks:
- 127.0.0.1/8
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 100.64.0.0/10
- 169.254.0.0/16
- ::1/128
- fe80::/64
- fc00::/7
allow_networks:
- 0.0.0.0/0
key_server: {}
media_api:
base_path: /var/dendrite/media
max_file_size_bytes: 10485760
dynamic_thumbnails: false
max_thumbnail_generators: 10
thumbnail_sizes:
- width: 32
height: 32
method: crop
- width: 96
height: 96
method: crop
- width: 640
height: 480
method: scale
room_server:
default_room_version: "10"
sync_api:
real_ip_header: ""
search:
enabled: false
index_path: /var/dendrite/searchindex
in_memory: false
language: en
user_api:
bcrypt_cost: 10
openid_token_lifetime_ms: 3600000
push_gateway_disable_tls_validation: false
auto_join_rooms: []
worker_count: 8
relay_api: {}
mscs:
mscs: []
tracing:
enabled: false
jaeger:
serviceName: ""
disabled: false
rpc_metrics: false
traceid_128bit: false
tags: []
sampler: null
reporter: null
headers: null
baggage_restrictions: null
throttler: null
manifests/matrix/deployment.yaml
+29
View File
@@ -0,0 +1,29 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: dendrite
labels:
app: dendrite
spec:
replicas: 1
selector:
matchLabels:
app: dendrite
template:
metadata:
labels:
app: dendrite
spec:
containers:
- name: dendrite
image: ghcr.io/element-hq/dendrite-monolith:latest
ports:
- containerPort: 8008
name: http
volumeMounts:
- name: config-volume
mountPath: /etc/dendrite
volumes:
- name: config-volume
secret:
secretName: dendrite-config
manifests/matrix/ingress.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: dendrite-ingress
annotations:
ingressClassName: traefik
spec:
rules:
- &host
host: matrix.kubernetes
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: dendrite
port:
number: 8008
- <<: *host
host: matrix.thehellings.com
manifests/matrix/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
namespace: matrix
resources:
- dendrite-config.yaml
- deployment.yaml
- service.yaml
- ingress.yaml
manifests/matrix/service.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
name: dendrite
labels:
app: dendrite
spec:
selector:
app: dendrite
ports:
- port: 8008
targetPort: http
protocol: TCP
type: ClusterIP
manifests/namespaces/kustomization.yaml
+1
View File
@@ -2,3 +2,4 @@ resources:
- external-secrets.yaml
- bitwarden.yaml
- db.yaml
- matrix.yaml
manifests/namespaces/matrix.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: matrix
manifests/secrets/kustomization.yaml
+1
View File
@@ -1,3 +1,4 @@
resources:
- postgres-user-gitlab.yaml
- postgres-user-pgadmin.yaml
- postgres-user-matrix.yaml
manifests/secrets/postgres-user-matrix.yaml
+33
View File
@@ -0,0 +1,33 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: postgres-user-matrix
namespace: db
spec:
target:
name: postgres-user-matrix
deletionPolicy: Delete
template:
type: Opaque
data:
username: |-
{{ .username }}
password: |-
{{ .password }}
data:
- secretKey: username
sourceRef:
storeRef:
name: bitwarden-login
kind: ClusterSecretStore
remoteRef:
key: 36d1046b-727e-4e09-a391-b2e90171d3d0
property: username
- secretKey: password
sourceRef:
storeRef:
name: bitwarden-login
kind: ClusterSecretStore
remoteRef:
key: 36d1046b-727e-4e09-a391-b2e90171d3d0
property: password
modules/nix-conf.nix
+1 -3
View File
@@ -30,7 +30,6 @@
]; # For home and for work machines
substituters =
(lib.optionals cache [
"http://nas.thehellings.lan:9000/binary-cache/"
"http://nas.home:9000/binary-cache/"
])
++ [
@@ -41,8 +40,7 @@
"https://cache.nixos.org"
];
trusted-public-keys = [
"nix.thehellings.lan:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
"nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
"nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
"ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
"nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
"greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="
modules/nixos/kubernetes.nix
+2 -1
View File
@@ -21,8 +21,9 @@ in
config = lib.mkIf cfg.enable {
age.secrets = {
kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
bw_secret.file = ../../secrets/kubernetes/bw_secret.age;
dendrite_key.file = ../../secrets/dendrite_key.age;
kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
};
environment.systemPackages = [
secrets/dendrite_key.age
BIN
View File
Binary file not shown.